@vellumai/assistant 0.12.2-staging.2 → 0.12.2-staging.4

package/src/runtime/routes/mcp-auth-routes.ts

@@ -17,7 +17,12 @@ import { z } from "zod";
 import type { McpServerConfig } from "../../config/schemas/mcp.js";
 import { estimateToolDefinitionTokens } from "../../context/token-estimator.js";
 import { reloadMcpServers } from "../../daemon/mcp-reload-service.js";
-import { McpClient } from "../../mcp/client.js";
+import {
+  mcpOAuthCredentialKey,
+  resolveMcpOAuthCredentialTarget,
+  workspaceMcpOAuthCredentialTarget,
+} from "../../mcp/credential-target.js";
+import { readEffectiveMcpConfig } from "../../mcp/effective-config.js";
 import { getMcpServerManager } from "../../mcp/manager.js";
 import { orchestrateMcpOAuthConnect } from "../../mcp/mcp-auth-orchestrator.js";
 import { getMcpAuthState } from "../../mcp/mcp-auth-state.js";
@@ -74,9 +79,7 @@ function persistWorkspaceMcpConfig(config: {
   try {
     saveWorkspaceMcpConfig(config);
   } catch (err) {
-    throw new InternalError(
-      err instanceof Error ? err.message : String(err),
-    );
+    throw new InternalError(err instanceof Error ? err.message : String(err));
   }
 }
 
@@ -91,8 +94,9 @@ async function handleMcpAuthStart({
 }> {
   const { serverId } = parseBody(McpServerIdParams, body);
 
-  const servers = loadWorkspaceMcpConfig().servers;
-  const serverConfig = servers[serverId];
+  const serverConfig = readEffectiveMcpConfig(loadWorkspaceMcpConfig()).servers[
+    serverId
+  ];
 
   if (!serverConfig) {
     throw new BadRequestError(`MCP server "${serverId}" not configured`);
@@ -105,10 +109,29 @@ async function handleMcpAuthStart({
     );
   }
 
+  const credentialTarget = resolveMcpOAuthCredentialTarget(
+    serverId,
+    serverConfig,
+  );
+  if (!credentialTarget) {
+    throw new BadRequestError(
+      `OAuth only supported for sse/streamable-http transports (server "${serverId}" uses ${transport.type})`,
+    );
+  }
+
+  try {
+    mcpOAuthCredentialKey(credentialTarget, "tokens");
+  } catch {
+    throw new BadRequestError(
+      `MCP server "${serverId}" has an invalid transport URL`,
+    );
+  }
+
   let result: { auth_url: string; already_authenticated?: boolean };
   try {
     result = await orchestrateMcpOAuthConnect({
       serverId,
+      credentialTarget,
       transport: {
         url: transport.url,
         type: transport.type,
@@ -135,7 +158,19 @@ function handleMcpAuthStatus({
   | { status: "complete" }
   | { status: "error"; error: string } {
   const { serverId } = pathParams as { serverId: string };
-  const state = getMcpAuthState(serverId);
+  const serverConfig = readEffectiveMcpConfig(loadWorkspaceMcpConfig()).servers[
+    serverId
+  ];
+  const target = serverConfig
+    ? resolveMcpOAuthCredentialTarget(serverId, serverConfig)
+    : null;
+  let targetKey: string | undefined;
+  try {
+    targetKey = target ? mcpOAuthCredentialKey(target, "tokens") : undefined;
+  } catch {
+    targetKey = undefined;
+  }
+  const state = targetKey ? getMcpAuthState(serverId, targetKey) : null;
 
   if (state === null) {
     throw new NotFoundError(`No active OAuth flow for server "${serverId}"`);
@@ -170,53 +205,6 @@ function handleMcpReload(_args: { body?: Record<string, unknown> }): {
   return { ok: true };
 }
 
-// ---------------------------------------------------------------------------
-// Health check helper
-// ---------------------------------------------------------------------------
-
-const HEALTH_CHECK_TIMEOUT_MS = 10_000;
-
-async function checkMachineReadableHealth(
-  serverId: string,
-  config: McpServerConfig,
-  timeoutMs = HEALTH_CHECK_TIMEOUT_MS,
-): Promise<string> {
-  const client = new McpClient(serverId);
-  try {
-    await Promise.race([
-      client.connect(config.transport),
-      new Promise<never>((_, reject) => {
-        const t = setTimeout(() => reject(new Error("timeout")), timeoutMs);
-        if (typeof t === "object" && "unref" in t) {
-          t.unref();
-        }
-      }),
-    ]);
-
-    if (client.isConnected) {
-      await client.disconnect();
-      return "connected";
-    }
-
-    const err = client.lastError;
-    if (err) {
-      if (err.message.includes("timeout")) {
-        return "error";
-      }
-      return "error";
-    }
-
-    return "needs-auth";
-  } catch {
-    try {
-      await client.disconnect();
-    } catch {
-      /* ignore */
-    }
-    return "error";
-  }
-}
-
 // ---------------------------------------------------------------------------
 // List
 // ---------------------------------------------------------------------------
@@ -271,12 +259,19 @@ async function handleMcpList(_args: {
   const configEntries = (
     Object.entries(servers) as [string, McpServerConfig][]
   ).filter(([, config]) => config && typeof config === "object");
+  const manager = getMcpServerManager();
 
   const workspaceEntries: McpServerEntry[] = await Promise.all(
     configEntries.map(async ([id, config]) => {
-      const status = await checkMachineReadableHealth(id, config);
+      const runtimeState = manager.getServerState(id, "workspace");
+      const status =
+        runtimeState === "connected" || runtimeState === "needs-auth"
+          ? runtimeState
+          : "error";
       const hasOAuth =
-        config.transport.type !== "stdio" ? await hasMcpOAuthTokens(id) : false;
+        config.transport.type !== "stdio"
+          ? await hasMcpOAuthTokens(workspaceMcpOAuthCredentialTarget(id))
+          : false;
 
       // Check credential store for stored static auth headers
       const storedHeaders = await getMcpHeaders(id);
@@ -316,21 +311,23 @@ async function handleMcpList(_args: {
   );
 
   return {
-    servers: [...workspaceEntries, ...listPluginServerEntries(configEntries)],
+    servers: [
+      ...workspaceEntries,
+      ...(await listPluginServerEntries(configEntries)),
+    ],
   };
 }
 
 /**
  * Project plugin-declared servers onto listing entries.
  *
- * Nothing here touches the credential store or the network: a plugin
- * server carries no auth state the assistant owns, and its status comes
- * from the manager's in-memory client rather than a probe (see
- * {@link PLUGIN_SERVER_STATUS}).
+ * OAuth presence is read from the plugin's scoped credential identity. Static
+ * workspace headers are never consulted, no network probe runs, and status
+ * comes from the manager's in-memory client (see {@link PLUGIN_SERVER_STATUS}).
  */
-function listPluginServerEntries(
+async function listPluginServerEntries(
   configEntries: [string, McpServerConfig][],
-): McpServerEntry[] {
+): Promise<McpServerEntry[]> {
   const { servers, issues } = readPluginMcpServers();
   for (const issue of issues) {
     log.warn(
@@ -349,36 +346,51 @@ function listPluginServerEntries(
   const workspaceIds = new Set(configEntries.map(([id]) => id));
   const manager = getMcpServerManager();
 
-  return servers
-    .filter((server) => {
-      if (!workspaceIds.has(server.id)) {
-        return true;
-      }
-      log.warn(
-        { plugin: server.pluginName, serverId: server.id },
-        "Plugin MCP server shadowed by a workspace server of the same id; skipping",
-      );
-      return false;
-    })
-    .map((server) => {
-      const { headers: _stripped, ...safeTransport } = server.config
-        .transport as Record<string, unknown>;
-      return {
-        id: server.id,
-        status: manager.getClient(server.id)?.isConnected
-          ? "connected"
-          : PLUGIN_SERVER_STATUS,
-        transport: safeTransport as McpServerEntry["transport"],
-        // A plugin server has no assistant-owned credentials. Resolving
-        // these against `mcp:<id>:*` would report, and could disclose, a
-        // workspace credential that happens to share the id.
-        hasOAuth: false,
-        hasStaticAuth: false,
-        authType: "none" as const,
-        source: "plugin" as const,
-        pluginName: server.pluginName,
-      };
-    });
+  return Promise.all(
+    servers
+      .filter((server) => {
+        if (!workspaceIds.has(server.id)) {
+          return true;
+        }
+        log.warn(
+          { plugin: server.pluginName, serverId: server.id },
+          "Plugin MCP server shadowed by a workspace server of the same id; skipping",
+        );
+        return false;
+      })
+      .map(async (server) => {
+        const { headers: _stripped, ...safeTransport } = server.config
+          .transport as Record<string, unknown>;
+        let hasOAuth = false;
+        const credentialTarget = resolveMcpOAuthCredentialTarget(
+          server.id,
+          server.config,
+        );
+        if (credentialTarget) {
+          try {
+            hasOAuth = await hasMcpOAuthTokens(credentialTarget);
+          } catch (err) {
+            log.warn(
+              { err, plugin: server.pluginName, serverId: server.id },
+              "Plugin MCP OAuth credential identity could not be resolved",
+            );
+          }
+        }
+        return {
+          id: server.id,
+          status:
+            manager.getServerState(server.id, "plugin") === "connected"
+              ? "connected"
+              : PLUGIN_SERVER_STATUS,
+          transport: safeTransport as McpServerEntry["transport"],
+          hasOAuth,
+          hasStaticAuth: false,
+          authType: "none" as const,
+          source: "plugin" as const,
+          pluginName: server.pluginName,
+        };
+      }),
+  );
 }
 
 // ---------------------------------------------------------------------------
@@ -687,7 +699,7 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "List MCP servers with health status",
     description:
-      "Returns configured MCP servers with live health-check results (connected, needs auth, error).",
+      "Returns configured MCP servers with recorded runtime status without opening new connections.",
     tags: ["internal"],
     responseBody: z.object({
       servers: z.array(

package/src/runtime/routes/plugins-routes.ts

@@ -80,6 +80,7 @@ import {
   PluginDirectoryNotFoundError,
 } from "../../cli/lib/toggle-plugin.js";
 import {
+  PLUGIN_UNINSTALL_WARNING_KEYS,
   PluginNotInstalledError,
   uninstallPlugin,
 } from "../../cli/lib/uninstall-plugin.js";
@@ -255,6 +256,14 @@ const pluginUninstallResponseSchema = z.object({
     .describe(
       "Absolute path that was removed on the assistant host. Useful for audit logs and confirmation toasts.",
     ),
+  warnings: z
+    .array(
+      z.literal(PLUGIN_UNINSTALL_WARNING_KEYS.MCP_OAUTH_CREDENTIALS_UNCHECKED),
+    )
+    .optional()
+    .describe(
+      "Stable keys for non-fatal cleanup limitations that should be localized at the presentation edge.",
+    ),
 });
 
 const pluginDetailsResponseSchema = z.object({
@@ -1134,7 +1143,11 @@ async function handleUninstallPlugin({
     const result = await uninstallPlugin({ name: rawName });
     await reconcilePluginSourcesNow();
     publishPluginsChanged(getOriginClientId(headers));
-    return { name: result.name, target: result.target };
+    return {
+      name: result.name,
+      target: result.target,
+      ...(result.warnings && { warnings: result.warnings }),
+    };
   } catch (err) {
     if (err instanceof InvalidPluginNameError) {
       throw new BadRequestError(err.message);

package/src/runtime/sync/resource-sync-events.ts

@@ -152,6 +152,10 @@ export function publishPluginsChanged(originClientId?: string): void {
   void publishSyncInvalidation([SYNC_TAGS.pluginsList], originClientId);
 }
 
+export function publishMcpChanged(): void {
+  void publishSyncInvalidation([SYNC_TAGS.mcpList]);
+}
+
 /**
  * Invalidate the activation-checklist progress resource on every client.
  *

package/src/tools/acp/status.test.ts

@@ -1,12 +1,12 @@
 /**
- * Tests for the `acp_status` tool's projection of session state.
+ * Tests for the `acp_status` tool's live and persisted session projection.
  *
- * The state the manager tracks feeds three surfaces with different budgets:
- * the HTTP route, the SSE picker, and this tool, whose output is spent on
- * LLM context. Only the fields an agent can act on belong here.
+ * The session manager owns live process state. Completed sessions move to
+ * durable history, where the status tool must keep them discoverable for
+ * follow-up work without making internal lifecycle guards treat them as live.
  */
 
-import { describe, expect, mock, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 import type { AcpSessionState } from "../../acp/types.js";
 import type { ToolContext } from "../types.js";
@@ -26,24 +26,49 @@ const RUNNING_STATE: AcpSessionState = {
   ],
 };
 
-let statusResult: AcpSessionState | AcpSessionState[] = RUNNING_STATE;
+let liveStates: AcpSessionState[] = [];
+let fakeStoredCredential: string | undefined;
 
 const realAcpModule = await import("../../acp/index.js");
 mock.module("../../acp/index.js", () => ({
   ...realAcpModule,
-  getAcpSessionManager: () => ({ getStatus: () => statusResult }),
+  getAcpSessionManager: () => ({
+    getStatus: () => liveStates,
+    getBufferedUpdates: () => [],
+  }),
 }));
 
+const realClaudeOauth = await import("../../acp/acp-claude-oauth.js");
+mock.module("../../acp/acp-claude-oauth.js", () => ({
+  ...realClaudeOauth,
+  storedClaudeTokenDigest: async () => fakeStoredCredential,
+}));
+
+import {
+  clearHistory,
+  insertHistoryRow,
+} from "../../acp/__tests__/helpers/acp-history-db.js";
+import { claudeTokenDigest } from "../../acp/acp-auth-marker-store.js";
+import { initializeDb } from "../../persistence/db-init.js";
+
 const { executeAcpStatus } = await import("./status.js");
 
+await initializeDb();
+
 const context = {
   conversationId: "conv-1",
   workingDir: "/tmp",
 } as unknown as ToolContext;
 
+beforeEach(() => {
+  liveStates = [];
+  fakeStoredCredential = undefined;
+  clearHistory();
+});
+
 describe("executeAcpStatus", () => {
-  test("a single session reports its model but not the picker", async () => {
-    statusResult = RUNNING_STATE;
+  test("a live session reports its model but not the picker", async () => {
+    liveStates = [RUNNING_STATE];
 
     const result = await executeAcpStatus({ acp_session_id: "acp-1" }, context);
 
@@ -62,33 +87,263 @@ describe("executeAcpStatus", () => {
     expect(result.content).not.toContain("Most capable");
   });
 
-  test("the listing drops the picker from every entry", async () => {
-    statusResult = [
-      RUNNING_STATE,
-      { ...RUNNING_STATE, id: "acp-2", model: "sonnet" },
-    ];
+  test("a cleanly completed resumable session is returned as idle", async () => {
+    insertHistoryRow({
+      id: "completed-1",
+      acpSessionId: "proto-completed-1",
+      startedAt: 2000,
+      completedAt: 3000,
+      status: "completed",
+      stopReason: "end_turn",
+      cwd: "/tmp/project",
+      task: "implement the parser",
+      usedTokens: 1200,
+      contextSize: 10000,
+    });
 
-    const result = await executeAcpStatus({}, context);
+    const result = await executeAcpStatus(
+      { acp_session_id: "completed-1" },
+      context,
+    );
+
+    expect(result.isError).toBe(false);
+    expect(JSON.parse(result.content)).toEqual({
+      id: "completed-1",
+      agentId: "claude",
+      acpSessionId: "proto-completed-1",
+      parentConversationId: "conv-1",
+      status: "idle",
+      startedAt: 2000,
+      completedAt: 3000,
+      stopReason: "end_turn",
+      task: "implement the parser",
+      latestUsage: {
+        usedTokens: 1200,
+        contextSize: 10000,
+      },
+      resumable: true,
+      lastRunStatus: "completed",
+    });
+  });
+
+  test("failed and cancelled history rows keep their terminal status", async () => {
+    insertHistoryRow({
+      id: "failed-1",
+      status: "failed",
+      error: "adapter failed",
+      cwd: "/tmp/project",
+    });
+    insertHistoryRow({
+      id: "cancelled-1",
+      status: "cancelled",
+      stopReason: "cancelled",
+      cwd: "/tmp/project",
+    });
 
+    const failed = await executeAcpStatus(
+      { acp_session_id: "failed-1" },
+      context,
+    );
+    const cancelled = await executeAcpStatus(
+      { acp_session_id: "cancelled-1" },
+      context,
+    );
+
+    expect(JSON.parse(failed.content)).toMatchObject({
+      status: "failed",
+      resumable: true,
+      lastRunStatus: "failed",
+      error: "adapter failed",
+    });
+    expect(JSON.parse(cancelled.content)).toMatchObject({
+      status: "cancelled",
+      resumable: true,
+      lastRunStatus: "cancelled",
+    });
+  });
+
+  test("a completed legacy row without cwd stays terminal", async () => {
+    insertHistoryRow({ id: "legacy-1", status: "completed", cwd: null });
+
+    const result = await executeAcpStatus(
+      { acp_session_id: "legacy-1" },
+      context,
+    );
+
+    expect(JSON.parse(result.content)).toMatchObject({
+      status: "completed",
+      resumable: false,
+      lastRunStatus: "completed",
+    });
+  });
+
+  test("a completed run stopped by cancellation stays terminal", async () => {
+    insertHistoryRow({
+      id: "partial-1",
+      status: "completed",
+      stopReason: "cancelled",
+      cwd: "/tmp/project",
+    });
+
+    const result = await executeAcpStatus(
+      { acp_session_id: "partial-1" },
+      context,
+    );
+
+    expect(JSON.parse(result.content)).toMatchObject({
+      status: "completed",
+      resumable: true,
+      lastRunStatus: "completed",
+      stopReason: "cancelled",
+    });
+  });
+
+  test("the listing includes live and persisted idle sessions", async () => {
+    liveStates = [RUNNING_STATE];
+    insertHistoryRow({
+      id: "idle-1",
+      startedAt: 2000,
+      status: "completed",
+      cwd: "/tmp/project",
+    });
+
+    const result = await executeAcpStatus({}, context);
     const payload = JSON.parse(result.content) as Array<
       Record<string, unknown>
     >;
-    expect(payload).toHaveLength(2);
-    expect(payload.map((entry) => entry.model)).toEqual([
-      "claude-opus-4-5",
-      "sonnet",
+
+    expect(payload.map((entry) => [entry.id, entry.status])).toEqual([
+      ["idle-1", "idle"],
+      ["acp-1", "running"],
     ]);
     for (const entry of payload) {
       expect(entry).not.toHaveProperty("availableModels");
+      expect(entry).not.toHaveProperty("eventLog");
+      expect(entry).not.toHaveProperty("cwd");
+      expect(entry).not.toHaveProperty("source");
+      expect(entry).not.toHaveProperty("authErrorCredential");
     }
   });
 
-  test("an empty listing says so rather than rendering an empty array", async () => {
-    statusResult = [];
+  test("live state wins over history for the same id", async () => {
+    liveStates = [RUNNING_STATE];
+    insertHistoryRow({
+      id: RUNNING_STATE.id,
+      status: "completed",
+      cwd: "/tmp/project",
+    });
 
+    const result = await executeAcpStatus(
+      { acp_session_id: RUNNING_STATE.id },
+      context,
+    );
+
+    expect(JSON.parse(result.content)).toMatchObject({
+      id: RUNNING_STATE.id,
+      status: "running",
+      agentId: RUNNING_STATE.agentId,
+    });
+  });
+
+  test("a truly unknown id keeps the not-found error", async () => {
+    const result = await executeAcpStatus(
+      { acp_session_id: "missing-1" },
+      context,
+    );
+
+    expect(result).toEqual({
+      content: 'ACP session "missing-1" not found',
+      isError: true,
+    });
+  });
+
+  test("an empty listing says so rather than rendering an empty array", async () => {
     const result = await executeAcpStatus({}, context);
 
     expect(result.content).toBe("No ACP sessions found.");
     expect(result.isError).toBe(false);
   });
+
+  test("withholds a persisted auth marker after the credential is replaced", async () => {
+    const refused = claudeTokenDigest("sk-ant-oat-refused");
+    insertHistoryRow({
+      id: "auth-failed-1",
+      status: "failed",
+      error: "authentication required",
+      cwd: "/tmp/project",
+      authErrorCode: "acp_claude_auth_required",
+      authErrorCredential: refused,
+    });
+    fakeStoredCredential = claudeTokenDigest("sk-ant-oat-replacement");
+
+    const result = await executeAcpStatus(
+      { acp_session_id: "auth-failed-1" },
+      context,
+    );
+
+    expect(JSON.parse(result.content)).toMatchObject({
+      id: "auth-failed-1",
+      status: "failed",
+      lastRunStatus: "failed",
+    });
+    expect(JSON.parse(result.content).authErrorCode).toBeUndefined();
+    expect(result.content).not.toContain("authErrorCredential");
+  });
+
+  test("keeps a persisted auth marker while the refused credential is current", async () => {
+    const refused = claudeTokenDigest("sk-ant-oat-refused");
+    insertHistoryRow({
+      id: "auth-failed-2",
+      status: "failed",
+      cwd: "/tmp/project",
+      authErrorCode: "acp_claude_auth_required",
+      authErrorCredential: refused,
+    });
+    fakeStoredCredential = refused;
+
+    const result = await executeAcpStatus(
+      { acp_session_id: "auth-failed-2" },
+      context,
+    );
+
+    expect(JSON.parse(result.content)).toMatchObject({
+      id: "auth-failed-2",
+      status: "failed",
+      authErrorCode: "acp_claude_auth_required",
+    });
+    expect(result.content).not.toContain("authErrorCredential");
+  });
+
+  test("keeps an older live session when 50 newer history rows exist", async () => {
+    liveStates = [
+      {
+        ...RUNNING_STATE,
+        id: "old-live",
+        startedAt: 1,
+      },
+    ];
+    for (let i = 0; i < 50; i++) {
+      insertHistoryRow({
+        id: `hist-${i}`,
+        acpSessionId: `proto-hist-${i}`,
+        startedAt: 1000 + i,
+        status: "completed",
+        cwd: "/tmp/project",
+      });
+    }
+
+    const result = await executeAcpStatus({}, context);
+    const payload = JSON.parse(result.content) as Array<{
+      id: string;
+      status: string;
+    }>;
+
+    expect(payload).toHaveLength(50);
+    expect(payload.some((entry) => entry.id === "old-live")).toBe(true);
+    expect(payload.find((entry) => entry.id === "old-live")?.status).toBe(
+      "running",
+    );
+    expect(payload[0]?.id).toBe("hist-49");
+    expect(payload.some((entry) => entry.id === "hist-0")).toBe(false);
+  });
 });